Hello everyone,
This is boggling my mind, and I literally have no idea what to do. This may or may not be in the correct section, so please move as appropriate.
A couple of days ago I received an email supposedly from Apple Support, saying the following:
My name is not 'joy', so I ignored it as spam. A second email soon followed, that had the following contents:
This email goes on and a copy of the terms is attached in a PDF that seems extremely legitimate (that I stupidly opened inside Chrome. However, VirusTotal says it's completely clean, 0/45 detected). Everything is spelled correctly.
At this point I started to get very worried. Someone seemingly purchased an AppleCare Protection Plan for me that I never knew about. They had my Macbook model and hardware serial, as well as my name and half my address correct. I immediately checked all my credit cards, but so far there are no charges, even today. I decided that maybe someone had hacked into my Apple ID account, which I never use, and bought stuff on ITunes - but after logging in, it seems there have been no orders.
This is where it gets strange. I work in IT, so I verified the emails were not phishing. All the headers point to actual Apple email servers. The links are all genuine and go to apple.com. The PDF is clean. However, after logging in with my Apple ID (the same one that received all the emails) and going to the AppleCare website, I clicked "View" under Agreements, and it says
This is under the same account that has the Macbook purchase on it, and the one that received the emails. 2 hours ago I received another email, also from a legitimate Apple.com email server, that said:
I have never called AppleCare. I have never purchased an agreement. I have no idea who Casey or 'joy' are. Can anyone explain to me how any of this is possible? No other accounts of mine have ever been compromised and I sincerely doubt I have a trojan anywhere.
This is boggling my mind, and I literally have no idea what to do. This may or may not be in the correct section, so please move as appropriate.
A couple of days ago I received an email supposedly from Apple Support, saying the following:
Code:
Dear joy,
Thank you for contacting Apple.
Your support Advisor, Jonathan, has a follow-up message for you:
271107467175
Based on the details you provided, we think you might find the following information helpful:
https://supportprofile.apple.com
Sincerely,
Apple SupportMy name is not 'joy', so I ignored it as spam. A second email soon followed, that had the following contents:
Code:
[Apple logo] AppleCare
AppleCare Protection Plan Certificate
Date Issued: August 11, 2013
****************[My correct legal name here]
12117 P******. [Correct street and #]
SAN FRANCISCO, CA 94117 [Incorrect city and state]
United States
Agreement No. 271107467***
Product Description Hardware Serial No. Coverage Period End Date
MACBOOK PRO (RETINA, 13-INCH, LATE 2012) C02JJ9FSD*** December 17, 2015 [This is all correct, INCLUDING the hardware serial]
Thank you for purchasing the AppleCare Protection Plan.
This certificate confirms AppleCare Protection Plan coverage for your Apple product(s). Please keep this certificate, the original sales receipts for your Apple product(s) and the included AppleCare Protection Plan Terms and Conditions. Proof of purchase may be required if there is any question regarding your Apple products eligibility for coverage by the AppleCare Protection Plan....This email goes on and a copy of the terms is attached in a PDF that seems extremely legitimate (that I stupidly opened inside Chrome. However, VirusTotal says it's completely clean, 0/45 detected). Everything is spelled correctly.
At this point I started to get very worried. Someone seemingly purchased an AppleCare Protection Plan for me that I never knew about. They had my Macbook model and hardware serial, as well as my name and half my address correct. I immediately checked all my credit cards, but so far there are no charges, even today. I decided that maybe someone had hacked into my Apple ID account, which I never use, and bought stuff on ITunes - but after logging in, it seems there have been no orders.
This is where it gets strange. I work in IT, so I verified the emails were not phishing. All the headers point to actual Apple email servers. The links are all genuine and go to apple.com. The PDF is clean. However, after logging in with my Apple ID (the same one that received all the emails) and going to the AppleCare website, I clicked "View" under Agreements, and it says
Code:
You do not have any registered agreements. Click Register an AppleCare Agreement to get started.This is under the same account that has the Macbook purchase on it, and the one that received the emails. 2 hours ago I received another email, also from a legitimate Apple.com email server, that said:
Code:
Dear Apple Customer:
We're very interested in getting your feedback regarding the last Advisor you spoke with, Casey, on your recent call to Apple support. The case id number for this call was: 490258379.
Your perspective is very important to Apple and the AppleCare team. All information you provide will be treated as confidential and will be used solely to improve our support programs and product offerings.
To complete this web survey, simply click on the web address (URL) displayed below or copy and paste the entire web address into the address field of your web browser.
http://csat.apple.com/ssurvey/nsurvey.html?id=51F3194
We appreciate your taking the time to let us know how well we are meeting your expectations.
Sincerely,
AppleCare Service and SupportI have never called AppleCare. I have never purchased an agreement. I have no idea who Casey or 'joy' are. Can anyone explain to me how any of this is possible? No other accounts of mine have ever been compromised and I sincerely doubt I have a trojan anywhere.
